@chibitek/chibi 0.1.176 → 0.1.177

package/dist-server/server/attachments.js

@@ -6,7 +6,7 @@ import { createReadStream, linkSync, mkdirSync, readFileSync, readdirSync, statS
 import { link, open, unlink } from "node:fs/promises";
 import { join, extname } from "node:path";
 import { DATA_DIR } from "./config.js";
-import { FILE_MIMES, IMAGE_MIMES, extensionForFileMime, extensionForMime, normalizedMime } from "./attachment-mimes.js";
+import { FILE_MIMES, IMAGE_MIMES, OTHER_FILE_EXTENSION, extensionForFileMime, extensionForMime, fileMime } from "./attachment-mimes.js";
 export { extensionForFileMime, extensionForMime };
 export const ATTACHMENTS_DIR = join(DATA_DIR, "attachments");
 /** The spec's ceiling: a screenshot bigger than this is rejected before it
@@ -255,12 +255,13 @@ async function withUploadLock(uploadId, operation) {
             uploadLocks.delete(uploadId);
     }
 }
-/** Every committed attachment name is `${uuid}${extension}` for one of these
- * fixed extensions — saveFile/saveImage never write any other suffix — so
- * whether a given upload ID is already committed, and under which content
- * type, can be answered with a handful of direct stats instead of a scan
- * over every file in the directory. */
-const KNOWN_ATTACHMENT_EXTENSIONS = Array.from(new Set([...Object.values(IMAGE_MIMES), ...Object.values(FILE_MIMES)]));
+/** Committed attachment names are `${uuid}${extension}`, mostly for one of
+ * these fixed extensions, so whether a given upload ID is already committed,
+ * and under which content type, can be answered with a handful of direct
+ * stats instead of a scan over every file in the directory.
+ * ponytail: a file of another type keeps its own extension, so reusing one
+ * upload ID across two such extensions is not caught; a prefix scan would. */
+const KNOWN_ATTACHMENT_EXTENSIONS = Array.from(new Set([...Object.values(IMAGE_MIMES), ...Object.values(FILE_MIMES), OTHER_FILE_EXTENSION]));
 /** Missing or unreadable candidates count as absent here; the atomic link
  * still detects a collision if a file exists when an upload commits. */
 function statSizeIfFile(path) {
@@ -297,14 +298,12 @@ async function digestFile(path) {
 function statusError(status, message) {
     return Object.assign(new Error(message), { status });
 }
-/** Strip platform-reserved characters and replace any sender-provided
- * extension with the canonical one for the accepted mime. Separators and
- * encoded separators are rejected rather than massaged so traversal attempts
- * remain visible as bad requests. */
+/** Strip platform-reserved characters. A known mime replaces any
+ * sender-provided extension with its canonical one; any other type keeps the
+ * sender's name as written. Separators and encoded separators are rejected
+ * rather than massaged so traversal attempts remain visible as bad requests. */
 export function sanitizeSharedFileName(name, mime) {
-    const extension = extensionForFileMime(mime);
-    if (!extension)
-        throw statusError(400, "content-type must be a supported document or audio type");
+    const extension = FILE_MIMES[fileMime(mime) ?? ""] ?? "";
     const normalized = name.normalize("NFKC").trim();
     if (!normalized)
         throw statusError(400, "name is required");
@@ -314,7 +313,7 @@ export function sanitizeSharedFileName(name, mime) {
         throw statusError(400, "name must be a filename, not a path");
     }
     const dot = normalized.lastIndexOf(".");
-    const withoutExtension = dot > 0 ? normalized.slice(0, dot) : normalized;
+    const withoutExtension = extension && dot > 0 ? normalized.slice(0, dot) : normalized;
     const safeCharacters = Array.from(withoutExtension, (character) => {
         const code = character.charCodeAt(0);
         return code <= 31 || code === 127 || "<>:\"|?*".includes(character) ? "_" : character;
@@ -333,12 +332,9 @@ export function sanitizeSharedFileName(name, mime) {
  * the request in memory. A failed, empty, or oversized upload leaves no
  * partial file behind. */
 export async function saveFile(chunks, originalName, mime, options = {}) {
-    const normalized = normalizedMime(mime);
-    if (!normalized || !extensionForFileMime(normalized)) {
-        throw statusError(400, "content-type must be a supported document or audio type");
-    }
+    const normalized = fileMime(mime) ?? "application/octet-stream";
     const name = sanitizeSharedFileName(originalName, normalized);
-    const extension = extensionForFileMime(normalized);
+    const extension = extensionForFileMime(normalized, name);
     const uploadId = validateAttachmentUploadId(options.uploadId);
     const expectedBytes = options.expectedBytes;
     if (expectedBytes !== undefined && (!Number.isSafeInteger(expectedBytes) || expectedBytes < 0)) {

package/dist-server/server/harness-import/history.js

@@ -173,7 +173,7 @@ export function uploadIdFor(key) {
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-5${hex.slice(13, 16)}-${variant}${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 /** The extension Atomic's store gives this file, for the already-saved check. */
-export const storedExtension = (file) => file.mime ? (file.image ? extensionForMime(file.mime) : extensionForFileMime(file.mime)) : null;
+export const storedExtension = (file) => file.mime ? (file.image ? extensionForMime(file.mime) : extensionForFileMime(file.mime, file.name)) : null;
 export function formatBytes(bytes) {
     if (bytes < 1024)
         return `${bytes} B`;

package/dist-server/src/lib/composer-attachments.js

@@ -72,6 +72,7 @@ const DOCUMENT_MIMES = {
     txt: "text/plain",
     md: "text/markdown",
     markdown: "text/markdown",
+    html: "text/html", htm: "text/html",
     csv: "text/csv",
     tsv: "text/tab-separated-values",
     json: "application/json",
@@ -271,16 +272,14 @@ export async function imageAttachmentFromFile(file, optimistic) {
         ...(optimistic?.previewUrl ? { previewUrl: optimistic.previewUrl } : {}),
     };
 }
-/** Copy a supported document or audio file into the private attachment store. The prompt
- * then carries the same durable path for the local agent and paired phones,
- * instead of exposing an arbitrary Finder path to the companion route. */
+/** Copy any file into the private attachment store. The prompt then carries the same durable
+ * path for the local agent and paired phones, instead of an arbitrary Finder path. */
 export async function fileAttachmentFromFile(file) {
     const declared = file.type.split(";", 1)[0].trim().toLowerCase();
     const extension = file.name.split(".").at(-1)?.toLowerCase() ?? "";
     const mime = documentMime(file) ??
-        (ACCEPTED_AUDIO_MIMES.has(declared) ? declared : AUDIO_MIMES_BY_EXTENSION[extension]);
-    if (!mime)
-        return null;
+        (ACCEPTED_AUDIO_MIMES.has(declared) ? declared : AUDIO_MIMES_BY_EXTENSION[extension]) ??
+        (/^[\w.+-]+\/[\w.+-]+$/.test(declared) ? declared : "application/octet-stream");
     if (file.size > FILE_MAX_BYTES) {
         throw Object.assign(new Error(`${file.name} exceeds 25 MB`), { status: 413 });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chibitek/chibi",
-  "version": "0.1.176",
+  "version": "0.1.177",
   "description": "Atomic by Chibitek: run your AI team's server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-hUu8lOok.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-BjvwttN3.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/assets/swimlanesDiagram-TC7HE7FX--A9LvTBi.js

@@ -1,8 +0,0 @@
-import{c as r,s as e}from"./flowDiagram-KWPJA3E3-DPy8GVYu.js";import{_ as a}from"./mermaid.core-BjvwttN3.js";import"./chunk-5VM5RSS4-B6OEecjg.js";import"./chunk-XXDRQBXY-WB5mOypF.js";import"./chunk-WEXAMYUT-5CvO78xu.js";import"./chunk-GWA4HPMP-k9aUZSoo.js";import"./channel-hUu8lOok.js";import"./index-CiUkZ0_j.js";var o=a(t=>`${e(t)}
-  .swimlane.cluster:not([data-color-id]) rect {
-    stroke: ${t.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,"getStyles"),s=o,u=r({styles:s});export{u as diagram};